App Service Easy Auth (Microsoft/Entra ID): consistent "invalid nonce claim" / Nonce cookie not found on every login after the first — Entra ID logs show Success

Question

App Service Easy Auth (Microsoft/Entra ID): consistent "invalid nonce claim" / Nonce cookie not found on every login after the first — Entra ID logs show Success

Integrity Biomedical Service 0

I'm running into a login failure with App Service's built-in Authentication ("Easy Auth") using Microsoft/Entra ID as the identity provider, single-tenant, that I can't resolve despite ruling out every cause I can find documentation for. Posting here in case anyone has seen this exact pattern before.

Environment:

App Service Plan: B1, Linux, Canada Central
Node.js app
Auth config: authsettingsV2
Single-tenant Microsoft identity provider
Instance count: 1 (confirmed, not scaled out)

Symptom:

The very first login after fully clearing cookies succeeds. Every login attempt after that fails — the browser bounces between my app and login.microsoftonline.com several times and ends on Microsoft's own "We couldn't sign you in. Please try again." This happens consistently now, not intermittently, across multiple devices, multiple accounts, and multiple browsers.

What the App Service diagnostics show:

Using Diagnose and solve problems → Authentication Configuration and Investigation, under "Easy Auth Errors/Warnings":

"Failed to read the 'Nonce' cookie for site '[mysite].azurewebsites.net': Cookie named 'Nonce' was not found." (recurring, dozens of times)
"Login token for '[user]' was rejected because contained an invalid 'nonce' claim." (recurring)

What Entra ID sign-in logs show:

Every single sign-in attempt for the affected account, at the exact times of these failures, is logged with Status: Success. There are no failed sign-ins on the Entra ID side. So authentication itself is succeeding every time — the rejection appears to happen specifically in App Service's own nonce validation, after the redirect back from Microsoft.

What I've already ruled out:

Browser cache/cookies — cleared fully, cross-device, same result
Recent deployments/restarts — 10+ hours with zero deployments, still fails
Multiple instances — confirmed single instance
Stale Microsoft SSO session — fully signed out at login.microsoftonline.com/common/oauth2/logout before retrying, still fails
App Registration "ID tokens" checkbox under Implicit grant and hybrid flows — confirmed enabled
App Registration Redirect URI — confirmed it exactly matches https://[mysite].azurewebsites.net/.auth/login/aad/callback
Deleted and re-added the identity provider entirely under App Service → Authentication (same App Registration, same tenant) — no change
Added loginParameters: ["prompt=login"] to identityProviders.azureActiveDirectory.login in authsettingsV2 to force a fully interactive login and rule out silent/seamless SSO as the trigger — the failure still happens identically, just with a visible login prompt each time instead of a silent one

Given Entra ID confirms success on every attempt, and every client-side/config-level cause I can find has been ruled out, this looks like it's happening specifically inside Easy Auth's own nonce validation logic. Has anyone run into this specific combination, or know of a fix or workaround that isn't covered by the usual "clear your cookies" advice (already tried, doesn't help beyond the very first login)?

Happy to share more diagnostic detail if it helps narrow this down.I'm running into a login failure with App Service's built-in Authentication ("Easy Auth") using Microsoft/Entra ID as the identity provider, single-tenant, that I can't resolve despite ruling out every cause I can find documentation for. Posting here in case anyone has seen this exact pattern before.

Environment:

App Service Plan: B1, Linux, Canada Central
Node.js app
Auth config: authsettingsV2
Single-tenant Microsoft identity provider
Instance count: 1 (confirmed, not scaled out)

Symptom:

The very first login after fully clearing cookies succeeds. Every login attempt after that fails — the browser bounces between my app and login.microsoftonline.com several times and ends on Microsoft's own "We couldn't sign you in. Please try again." This happens consistently now, not intermittently, across multiple devices, multiple accounts, and multiple browsers.

What the App Service diagnostics show:

Using Diagnose and solve problems → Authentication Configuration and Investigation, under "Easy Auth Errors/Warnings":

"Failed to read the 'Nonce' cookie for site '[mysite].azurewebsites.net': Cookie named 'Nonce' was not found." (recurring, dozens of times)
"Login token for '[user]' was rejected because contained an invalid 'nonce' claim." (recurring)

What Entra ID sign-in logs show:

Every single sign-in attempt for the affected account, at the exact times of these failures, is logged with Status: Success. There are no failed sign-ins on the Entra ID side. So authentication itself is succeeding every time — the rejection appears to happen specifically in App Service's own nonce validation, after the redirect back from Microsoft.

What I've already ruled out:

Browser cache/cookies — cleared fully, cross-device, same result
Recent deployments/restarts — 10+ hours with zero deployments, still fails
Multiple instances — confirmed single instance
Stale Microsoft SSO session — fully signed out at login.microsoftonline.com/common/oauth2/logout before retrying, still fails
App Registration "ID tokens" checkbox under Implicit grant and hybrid flows — confirmed enabled
App Registration Redirect URI — confirmed it exactly matches https://[mysite].azurewebsites.net/.auth/login/aad/callback
Deleted and re-added the identity provider entirely under App Service → Authentication (same App Registration, same tenant) — no change
Added loginParameters: ["prompt=login"] to identityProviders.azureActiveDirectory.login in authsettingsV2 to force a fully interactive login and rule out silent/seamless SSO as the trigger — the failure still happens identically, just with a visible login prompt each time instead of a silent one

Given Entra ID confirms success on every attempt, and every client-side/config-level cause I can find has been ruled out, this looks like it's happening specifically inside Easy Auth's own nonce validation logic. Has anyone run into this specific combination, or know of a fix or workaround that isn't covered by the usual "clear your cookies" advice (already tried, doesn't help beyond the very first login)?

Happy to share more diagnostic detail if it helps narrow this down.

0 comments

1 answer

Your answer

Answer 1

Check this thing first since it might explain why only the first login works. After a failure, delete only the "Easy Auth's own"AppServiceAuthSession cookies rather than clearing everything, then retry. If that alone fixes it, the session cookie is interfering with the nonce cookie and you're chasing a different problem than a config one.

You've confirmed the redirect URI matches the App Registration, but not that the domain you're browsing is the domain the callback lands on. Microsoft's nonce troubleshooting names that as the first cause. The nonce cookie is set on whichever domain starts the login, cookies are domain-scoped, and if the token comes back to a different hostname the cookie simply isn't in that request. It's written for ASP.NET MVC rather than Easy Auth, but the mechanism is the same.

So worth checking whether you have a custom domain bound while the reply URL is azurewebsites.net, or anything redirecting between the two, CDN, Front Door, etc.

The same article's second cause is SameSite. Auth cookies need SameSite=None; Secure because the callback from Microsoft is a cross-site POST. Easy Auth sets that itself, but it's worth looking at the actual Set-Cookie header on the Nonce cookie in a network trace to see what's really going out.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.